Cloudflare vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20218
3. 202210
4. 202322
5. 20244
6. 20257
7. 202613

Newest CVEs

• CVE-2026-105299

  Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments

  Cloudflare · https://github.com/cloudflare/pingora

  High8.7
• CVE-2026-105298

  Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

  Cloudflare · https://github.com/cloudflare/pingora

  Medium6.3
• CVE-2026-105297

  Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits

  Cloudflare · https://github.com/cloudflare/pingora

  High7.5
• CVE-2026-11325

  cloudflare/pages-action is deprecated — migration required by September 18th, 2026

  Cloudflare · https://github.com/cloudflare/pages-action

  High8.8
• CVE-2026-12523

  Resource exhaustion in quiche HTTP/3 and QPACK layers

  Cloudflare · quiche

  High7.5
• CVE-2026-12707

  Unbounded path event queue growth in quiche via peer-driven source connection ID rotation

  Cloudflare · quiche

  High7.5
• CVE-2026-14440

  Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records

  Cloudflare · Universal SSL

  High7.6
• CVE-2026-11941

  Use-after-free in connection ID iterator and FFI functions

  Cloudflare · Quiche

  Medium5.6
• CVE-2026-2836

  Cache poisoning via insecure-by-default cache key

  Cloudflare · https://github.com/cloudflare/pingora

  High8.4
• CVE-2026-2835

  HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

  Cloudflare · https://github.com/cloudflare/pingora

  Critical9.3